Here is the condition: I have a web service API that I am planning to sell as a service. The output of the API contains URI of some resources (say images, videos) that should be accessible to that guy using API.

Exposing URI as is, seems like a bad idea since they can just visit that resource and navigate through.

What I tried?

Selective Passsword protecting the URI resources from apache server configuration. But this would prevent every client from displaying those resources.

What others are doing?

I just looked at how facebook was doing this and it seems they have some sort of encrypted URL for image resources.

Following is an example I got from Barack Obama's FB page:


How do I achieve this level of security? what are the standard practices and how should I go about implementing them? Any leads would be appreciated!!

5 Answers 5


Normally an API will be protected by an API Key or an API Secret which is commonly sent in the headers. However, with the wide acceptance of OAuth, developers seems to use this method, which they can set the time for refreshing an OAuth token which is a much better way.

If you still need more protection for your API, (Which I Guess some bank or payment related ones), normally the client send an encrypted string to the server, the server decodes it, then send the response back again in an encrypted string.

So the person with the key can only decrypt the string.

So, in fact, you can mix API secret method with API string encryption for a stronger method.

  • my concern is about securing the content of the output of the api.. request to read the question and the details again Commented Feb 23, 2017 at 8:40

What you describe is a common use case for resources that are stored in a database or that are dynamically generated. In that case, there is no permanent URL for the resource, but only dynamically generated ones.

In that case, when you get a valid request, the application reads the file and directly writes the content of the file in the response that is sent back to the client. For example In JavaEE, a servlet will process the request, ensure that it is valid, read the file and directly copy the content to the Response output stream.

If you need more details on how to do that, you could try to ask on SO site - do not forget to show that you have done some research and my advice is to first write some code...


I am not getting the idea about navigate through do you mean directory listing or accessing other files through that uri location. if that is the case you can turn off directory listings and other file access, easily through apache config or .htaccess file or if you are having thought, that your original uri can give the idea about your project structure you can rewrite your url using mod_rewrite easily in a .htaccess file.

  • Yes I mean directory listing and my contents are not dynamically generated Commented Feb 23, 2017 at 11:46

If the files you need to secure are large static files and you want to benefit from web servers that are optimized for serving static files rather than having your application server serves the large static files, you'd want to look into X-SendFile/X-Accel-Redirect feature that many popular webservers supports.

In a brief, these headers allows you to have your web server actually serve the files but have your application authenticates the request to decide whether or not the access is permitted or even to serve different files to different users. Using these headers, you can, for example, redirect the user to a forbidden error page or to the authentication page if the user don't have access to or is not logged in when they try to access the static file's URL. If the user is logged in and is permitted to access the file, then all you need to do is set the header to serve the file that you want the user to get and when the web server processes your application server's response, it will replace the response body with the file pointed by the header.


Clearly problem for me was directory listing. So disabling directory listing solves my issue.

Here's how to do it:

open the following file:


Find the Following lines

<Directory /var/www/>
# You uncomment the line below to enable the directory listing in Apache
#   Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted

Allow file access but password protect directory listing

Password protect your apache server content

One of my other requirements was that I wanted to allow file access when properly URLed (from api output xml). (i.e. above rule for password protection will work only for the directory and files can be accessed)

I achieved that by adding the following rule:

<Files ?*>
    Order allow,deny
    Allow from all
    Satisfy any

which effectively says that files can be accessed.

Here is the apache directory listing documentation

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .